ICO call for views on a data protection and journalism code of 
practice 


Introduction 


The Information Commissioner is calling for views on a data protection and journalism code 
of practice (the code). 


The Data Protection Act 2018 requires the Commissioner to produce a code of practice that 
provides practical guidance and promotes good practice in regard to processing personal 
data for the purposes of journalism. Our intention is for the code to provide practical, 
pragmatic guidance for journalists on how to comply with data protection legislation, building 
on the detailed guidance that we have already produced for this sector. 


This call for views is the first stage of the consultation process. The Commissioner is seeking 
input from relevant stakeholders, including media organisations, trade associations, data 
subjects and those representing the interests of data subjects. We will use the responses we 
receive to inform our work in developing the code. 


The Information Commissioner welcomes feedback on the specific questions set out below. If 
you would like further information on the call for views, please read our blog post here (link 
to blog post), or email journalismcode@ico.org.uk. 


The call for views will be open until Friday 17th May 2019. 
Privacy statement 


For this consultation we will publish all responses except for those where the respondent 
indicates that they are an individual acting in a private capacity (e.g. a member of the 
public). All responses from organisations and individuals responding in a professional 
capacity (e.g. academics, freelance journalists, sole traders, legal professionals) will be 
published. We will remove email addresses and telephone numbers from these responses 
but apart from this we will publish them in full. 


For more information about what we do with personal data please see our privacy notice. 


Please note that we are using the platform Snap Surveys to gather this information. Any 
data collected by Snap Surveys for ICO is stored on UK servers. You can read their Privacy 
Policy here. 


Section 1: Your views on the code 


Qi We are considering using our current guidance "Data protection and journalism: a 
guide for the media” as the basis on which we will build the new journalism code. Do 
you agree or disagree with this approach? 


Agree 
© Disagree 


Q2 


Q3 


If you disagree , please explain why? 


The tone of that ‘guide’ is that of a regulator dictating to its subjects. This is 
inappropriate and out of scope for the ICO; it has no press regulation function in 
statute and this guide reads like a step-by-step ‘how to do journalism’ written by 
people with no experience of working in the trade - people, moreover, who have no 
function in issuing such a wide-ranging guide. Future regulation must stick strictly to 
the Data Protection Act with due emphasis on the exemptions. Detailed rules on the 
method and practice of journalism, whether or not they are disguised in the language 
of DPA compliance, are inappropriate for the ICO and beyond its remit. 


"Data protection and journalism: a guide for the media” is split into three sections: 
-Practical guidance” aimed at anyone working in the journalism sector; 


Technical guidance” aimed at data protection practitioners within media 
organisations; and 


Disputes”, aimed at senior editors and staff responsible for data protection 
compliance. 


Do you think we should retain this structure for the code? 


Yes 


© No 


Q4 If no, do you have any suggestions about how we should structure the code? 


With the exception of the handful of national newspapers and broadcasters, most 
DPA compliance falls on the heads of people with day jobs to attend to. Data 
protection compliance is not a fulltime priority in most SMEs, as the ICO ought to 
know well. Future guidance ought to be written for time-poor people attending to it 
as a second or third duty, not from the point of view of fulltime compliance officers. 
The latter is a small enough subset of this industry that they can be dealt with ona 
case-by-case basis. 


Q5 Do you think the ICO’s existing guidance for journalists addresses the main areas 
where data protection issues commonly arise? 


Yes 


O No 


Q6 


If no, what additional areas would you like to see covered? 


The first half of the existing guidance was clearly written by people who see 
themselves as a journalism regulator-in-waiting. It needs to be scrapped and 
rewritten to address real-world considerations, not endless hectoring about when to 
publish facts and whether publishing facts can ever be justified - matters that DPA19 
simply does not address, no matter how badly the authors of the existing guide 
evidently wanted it to. Delete the first half of the guide and stick to the legal 
explanations. These are what matters to newsrooms in 21st Century Britain. 


Q7 The journalism code will address changes in data protection law, including 
developments in relevant case law. Are there any particular changes to data 
protection law that you think we should focus on in the code? 


Q8 


Apart from recent changes to data protection law, are there any other developments 


that are having an impact on journalism that you think we should address in the 
code? 


My industry is suffering death by a thousand cuts thanks in part to interfering 
busybodies and shark-like lawyers who want to abuse data protection law as a 
workaround to the law of libel. The best thing you can do is butt out and make it 
clear that the ICO has no role of any sort in media regulation. 


Q9 


Are there any case studies or journalism scenarios that you would like to see included 
in the journalism code? 


Send the authors of the future code to a variety of newsrooms. Not just obliging 
national newspapers who'll tell you what you want to hear - local papers, 
specialist/niche publications, news magazines. Useful case studies could include what 
to do on receipt of an SAR, including how to responsibly refuse to respond (SAR- 
based disruption tactics are used by individuals who know or suspect they are the 
subject of an investigation into their business dealings). Reference to section 10 of 
the Contempt of Court Act 1981 would be useful, as the prohibition on disclosing 
names of sources appears to either be complementary to the ICO rules or 
contradictory, depending which part of the existing ICO rules you read. 


Q10 Do you have any other suggestions for the journalism code? 


Keep it relevant and limited to the Data Protection Act only. Do not repeat the 
mistake of the previous guide by trying to turn it into a manual of journalism 
regulation. I had no idea the previous guide existed and having read it, half of the 
material - roughly the first 25 pages - is simply irrelevant. The legal guidance is what 


matters and is of value, not some bureaucrat's personal morals on what she thinks 
journalists ought to do at work. 


Section 2: About you 


Are you? 


Q11 Are you? 
(_) A media organisation? 
) A trade association? 
._) An organisation representing the interests of data subjects? 
_.) An academic? 
© An individual acting in a professional capacity? 
_) An organisation that regulates press standards? 


, An individual acting in a private capacity (e.g. someone providing their views as a 
” member of the public)? 


`) Other? 
Please specify: 


Q12 How did you find out about this survey? 

) ICO website 

© Social media 
) Conference/seminar 
`) Trade/professional association 
) Media 
) Word of mouth 

Other? 
Please specify: 


We may want to contact you about some of the points you have raised. If you are 
happy for us to do this please provide your email address: 


Thank you for taking the time to share your views and experience. 


